CTF & practice

Decode: Q1lCRVJ7aGVsbG9fd29ybGR9

Skills: Encoding · Hint: Use CyberChef "From Base64".

ASCII hex 43 59 42 45 52 7b 68 65 78 7d → flag

Skills: Encoding · Hint: C Y B E R { h e x }

Flag is CYBER{<port of HTTPS>}

Skills: Ports · Hint: Think TLS.

Private RFC1918 10.0.0.0/? length for /8 class A. Flag CYBER{n}

Skills: Networking · Hint: Class A slash.

Default SSH TCP port? CYBER{n}

Skills: Ports · Hint: Not 23.

HTTPS default port? CYBER{n}

Skills: TLS · Hint: Same as Port Riddle.

Default RDP TCP port? CYBER{3389}

Skills: Ports · Hint: Thirty-three eighty-nine.

Which ls flag reveals dotfiles? Flag: CYBER{-x}

Skills: Linux · Hint: a for all.

Recommended mode for private SSH key? CYBER{mode}

Skills: Linux · Hint: Owner rw only.

Which cookie flag blocks JavaScript access? CYBER{flag}

Skills: Web Security · Hint: Http...

How many dot-separated parts does a JWT have? CYBER{n}

Skills: Web, Tokens · Hint: header.payload.signature

Which SameSite value is strictest? CYBER{value}

Skills: CSRF · Hint: Not Lax.

HTTP status for unauthorized? CYBER{code}

Skills: HTTP · Hint: Unauthenticated.

SQLi is primarily which OWASP class idea? CYBER{injection}

Skills: OWASP · Hint: Injection.

Authenticated but not allowed → status? CYBER{code}

Skills: HTTP · Hint: Forbidden.

ROT13: PLORE{ebgngr}

Skills: Crypto · Hint: Shift by 13.

One-way fingerprint function category? CYBER{hashing}

Skills: Crypto · Hint: Not encryption.

A file starts with 89 50 4E 47. Flag: CYBER{extension}

Skills: Forensics · Hint: ‰PNG

Which Linux tool prints printable text in binaries? CYBER{tool}

Skills: Reversing · Hint: Title.

What DNS record type lists mail servers? CYBER{type}

Skills: OSINT · Hint: Mail eXchanger.

What octal perm in find marks SUID? CYBER{-xxxx}

Skills: Linux, PrivEsc · Hint: find / -perm ...

File-format signature language often used in malware hunting? CYBER{tool}

Skills: Detection · Hint: Yet Another…

MITRE technique IDs look like T####. Flag the letter prefix: CYBER{T}

Skills: ATT&CK · Hint: Techniques start with T.

Common failed logon Event ID? CYBER{4625}

Skills: Windows · Hint: Forty-six twenty-five.

Which letter stands for ensuring data is not altered? CYBER{X}

Skills: Fundamentals · Hint: Integrity.

Grant only needed rights. Principle name one word: CYBER{word}

Skills: Security Concepts · Hint: Least privilege (use least).

Classic cloud metadata IP? CYBER{a.b.c.d}

Skills: SSRF, Cloud · Hint: Link-local.

Never trust, always _____ ? CYBER{verify}

Skills: Architecture · Hint: Verify.

CVSS scores _____ of vulns. CYBER{severity}

Skills: CVSS · Hint: Severity.

Ticket-granting ticket acronym? CYBER{tgt}

Skills: AD · Hint: Three letters.

OWASP mobile verification standard acronym? CYBER{masvs}

Skills: Mobile · Hint: M-A-S-V-S.

Limit blast radius phase name? CYBER{containment}

Skills: IR · Hint: Contain…

S in SAST stands for? CYBER{static}

Skills: DevSecOps · Hint: Not dynamic.

Mitigation that randomizes address layout acronym? CYBER{aslr}

Skills: Exploit · Hint: Address Space…

Changing /api/user/1001 to 1002 without authZ is called BOLA. Flag: CYBER{bola}

Skills: API · Hint: Broken Object Level Authorization.

Limit query depth to stop resource exhaustion. Control name (one word): CYBER{depth}

Skills: GraphQL · Hint: Complexity/depth limits.

Missing state parameter enables CSRF on OAuth login. Flag: CYBER{state}

Skills: OAuth · Hint: CSRF token for OAuth.

Smuggling class when CL and TE disagree: CYBER{smuggle}

Skills: HTTP · Hint: Request smuggling.

External entity in XML often starts with: CYBER{DOCTYPE}

Skills: XML · Hint: DOCTYPE declaration.

Time-of-check-time-of-use acronym: CYBER{toctou}

Skills: Logic · Hint: TOCTOU.

Running container as root is bad practice. Better directive: CYBER{USER}

Skills: Containers · Hint: Dockerfile USER.

Namespaced RBAC object: CYBER{Role}

Skills: K8s · Hint: Not ClusterRole.

Dangerous CIDR for SSH from internet: CYBER{0.0.0.0/0}

Skills: IaC · Hint: Open to world.

Common SBOM format acronym: CYBER{spdx}

Skills: Supply chain · Hint: SPDX or CycloneDX in real life.

Sigma converts to SIEM queries. Target system type: CYBER{siem}

Skills: Detection · Hint: Detection platform.

YARA rule sections: strings + ___? CYBER{condition}

Skills: Malware · Hint: Third section.

Anti-spoofing trio includes DMARC — first letter D stands for? CYBER{domain}

Skills: Email · Hint: Domain-based Message Authentication…

DNSSEC uses RRSIG records for signatures. Flag: CYBER{rrsig}

Skills: DNS · Hint: Resource Record Signature.

Worst IAM action wildcard: CYBER{*}

Skills: Cloud · Hint: Action star.

Volatility plugin to list processes: CYBER{pslist}

Skills: Forensics · Hint: Windows pslist.

Treat user content as: CYBER{untrusted}

Skills: LLM · Hint: Never trusted.

RAG risk when ACLs fail: CYBER{retrieval}

Skills: RAG · Hint: Wrong chunks returned.

Default agent tool policy: CYBER{deny}

Skills: Agents · Hint: Allow-list only.

Protocol to share STIX: CYBER{taxii}

Skills: Intel · Hint: TAXII.

Correlate multiple IOC types by campaign: CYBER{campaign}

Skills: Intel · Hint: Campaign ID.